Introducing the Square Enix Security Token

[Devia]

"You want an FFXI character? That'll be $12.95 please. Oh. You want a SECURE account? That'll cost you extra ..."

[Pikarya]

"You want an FFXI character? That'll be $12.95 please. Oh. You want a SECURE account? That'll cost you extra ..."

Last time I checked using common sense. I think it was free?

[Whaleporn]

"You want an FFXI character? That'll be $12.95 please. Oh. You want a SECURE account? That'll cost you extra ..."

You may think you are funny and clever but let me be the second person to tell you that you're not.

[Seraph]

"You want an FFXI character? That'll be $12.95 please. Oh. You want a SECURE account? That'll cost you extra ..."

You want a padlock on your front door? That costs extra too.




So do condoms. Let your parents know.

[Soa]

We use these things at my work, and they are definitely secure, but if something happens to it (breaks, lost, etc) the process of getting a new one is painful. It usually takes up to a week to get a replacement and you have to keep requesting temp passwords in the meantime.

I have 2 other people that access my account semi-regularly so I probably won't get it, but if they include an option to turn it off I may get one. Another issue is having to deal with SE if something happens. I have no faith whatsoever that they will make things easy for you.

[Pearlsea]

Your going to pay $10 USD tops for the same technology used in some of the safest security clearances. Id say its worth it.

[Pikarya]

Hopefully you don't need to registration codes to buy one of these.

Probably basic verification of the account is all. Or the CCV code on the back of your current card, etc. Highly doubt they would do that, if you call their call center. They rare ever turn your help down due to your Registration code being missing. (The will turn you down though for just being fucking idiots.)

[Araelus]

Anyone that did would instantly be rich and famous. The guy was just talking out of his ass.

XKCD

I once asked a guy from the NSA if they had cracked RSA. I know he told me the truth because I asked, "Are you lying?" and he said "No."

Like many, I've been waiting on this move for a long time. SE mentioned getting SecurID tags months ago, and then it never seemed to pan out. I'd go for it if it really is using RSA - better

[Mizango]

Wow, it's about fucking time. We use those here at work and they are amazing.

Kudos for SE for actually you know, putting effort into safeguarding something.

[Kipling]

Last time I checked using common sense. I think it was free?

Hahahaha.

[Cesaria]

I'm betting they'll implement these... for US only. Canada, Europe and the rest of the world can just sit open to being hacked for another 4 months and then pay triple the price. If they introduce it for all areas at once - I'll be shocked.

[alabamahotpocket]

While this Security Token is great for account password protection, its useless against session hijacking type of trojans because of the way ffxi is designed.

Let me explain what i mean with an example. Ill use the windower plugin LightLuggage as example (im not saying LL is a trojan lol, just using it to explain session hijacking).

As plugin developer, i could add some extra code to this plugin that only gets activated if a character named "Somerandomcharacter" sends the plugin user (the victim) a trade request. Once this trade request is sent from the exploiter (in this case me, the developer), the plugin could block all the user input from windower, and start sending keyboard commands to the game. It only takes a few key clicks to accept the trade, put up all your Gil in trade window and hit OK. All trades are final, right?

If the trojan was well written, it could even check players equip and unequip high priced items (like KC) for trading. Same with bazaars.

There's no security code to confirm if the trade was legit or not (unless the "in-game bonus" in announcement means you can use the device to confirm in-game trades, bazaaring, delivery boxing and selling on AH).

The plugin dont even need internet access, so your firewall and antivirus programs would not protect you in this case. Having access to FFXI data in your PC memory is good enough.

Since the source code of the plugin is not open to public, you cant really know if something extra was added to it. You probably wont even know which plugin did it. It could happen while you are afk to eat or just doing overnight bazaaring.

Also, this dont have to be windower plugin. Im just using it as example since many ppl use those. It could be some random virus you picked up from somepage.com or the functionality could be built in the claiming bot you are using.

As long as the FFXI items/gil can be turned into real life money, RMT will be after your stuff, and they dont care what methods are used to get it.

/cheers

[Spira]

While this Security Token is great for account password protection, its useless against session hijacking type of trojans because of the way ffxi is designed.

Let me explain what i mean with an example. Ill use the windower plugin LightLuggage as example (im not saying LL is a trojan lol, just using it to explain session hijacking).

As plugin developer, i could add some extra code to this plugin that only gets activated if a character named "Somerandomcharacter" sends the plugin user (the victim) a trade request. Once this trade request is sent from the exploiter (in this case me, the developer), the plugin could block all the user input from windower, and start sending keyboard commands to the game. It only takes a few key clicks to accept the trade, put up all your Gil in trade window and hit OK. All trades are final, right?

If the trojan was well written, it could even check players equip and unequip high priced items (like KC) for trading. Same with bazaars.

There's no security code to confirm if the trade was legit or not (unless the "in-game bonus" in announcement means you can use the device to confirm in-game trades, bazaaring, delivery boxing and selling on AH).

The plugin dont even need internet access, so your firewall and antivirus programs would not protect you in this case. Having access to FFXI data in your PC memory is good enough.

Since the source code of the plugin is not open to public, you cant really know if something extra was added to it. You probably wont even know which plugin did it. It could happen while you are afk to eat or just doing overnight bazaaring.

Also, this dont have to be windower plugin. Im just using it as example since many ppl use those. It could be some random virus you picked up from somepage.com or the functionality could be built in the claiming bot you are using.

As long as the FFXI items/gil can be turned into real life money, RMT will be after your stuff, and they dont care what methods are used to get it.

/cheers

well, surely, there are 101 ways to try to get your hands on someone elses stuff illegally. no one is denying that possibility, but rather we're celebrating that something is being done to secure the most commonly exploited route by which accounts are hacked/stuff is stolen..

what you're saying is (as far as i know) not something that has been employed by thieves yet even if its possible and the most we can do really is to try to be as safe as we can. or play on ps2 or xbox360.. which probably isnt enough either.
prevention is better than cure, as the old adage goes, but this cure for an old theft problem is always more than welcome

[Mayareira]

Meh, was expecting a fingerprint/retinal scanner. Not bad though!

[luciferu]

I was expecting a rectal scanner, too bad for my anus.

[ninjafox]

You can get a trojan through trading people? People randomly trade other people stuff?

[Devek]

I never can find a trojan big enough.

[Mizango]

Those were all hypothetical scenarios he was merely using to get his well stated point across; being that nothing is 150% fool proof. NOTHING.

No worries.

I never can find a trojan big enough.

[Thiefami]

your gear would be gone but your account would be safe, so technically your account is still secure! Therefore SE has provided, and exerted every means to protect your account. While on subject using any thirdparty tool is against ToS, and is also not recommended by SE so that is a risk you take.

[Reapz]

Damn, I want one of these but if it's like all their other products that don't ship to other countries I get screwed over. Here's hoping they change their ways for this :/